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(1). (U) A description of the review of related NRO acquisitions for potential or actual bias, unfair 
competitive advantage, and impaired objectivity. 


4S LACEREL-FOHSAC PE) Background: The 100G Ethernet Encryptor (100G EE) contract will 
design, develop and achieve certification of a high speed (100 gigabits per second) cryptographic 


product to encrypt and decrypt strategic network communications, in support of the NRO 
Infrastructure Service Provider (NISP] NISP (b)(3) 


requirements are the primary driver for the 100G EE 
































(U) We have reviewed this acquisition for potential or actual OCI. We analyzed the nature of the 
work to be performed on this contract in order to identify and evaluate potential OCI. A search 
for related NRO acquisitions indicated there were no related acquisitions in the NRO. 
COMM/IAO has formally briefed the proposed acquisition to the principal NRO customer (NISP) 
as well as to other internal/external stakeholders. COMM/IAO also reviewed internal research 
efforts as well as those sponsored by other NRO directorates (including AS&T) and Intelligence 
Community organizations, and concluded that no related acquisitions were being pursued. The 
work to be performed under this contract does not involve those services — such as 
management support or technical direction — where one typically finds potential OCI. It is not 
anticipated that any actions taken or relationships established under this contract will give rise 
to OCI issues either at present or in the future. 


(U) However, in November 2013, NSA/IAD representatives advised NRO that they were 
considering a Commercial COMSEC Evaluation Program (CCEP) agreement with an interested 
vendor to develop a 100G encryptor. A CCEP agreement establishes a bilateral, non-contractual 
relationship between NSA/IAD and a vendor whereby the vendor develops and produces an IA 
product at its own risk and expense, and NSA may certify the product. Because the vendor pays 
for the CCEP development, neither the user nor NSA/IAD has any control of the technical 
requirements and development schedule. Furthermore, a vendor may choose to walk away 
from the CCEP agreement at any time, subject to a 30-day notice. For these reasons, COMM 
concluded that pursuing a CCEP development for its 100G EE requirement would not meet NRO 
mission needs and chose to continue its competitive acquisition effort. 


(U/4-6¥8) During the period November 2013 through December 2013, immediately after 
hearing of NSA’s intent to pursue a CCEP agreement for a 100G encryptor development, 


COMM/IAO requested that any NSA/IAD personnel (advisors) directly involved with the 
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potential CCEP effort recuse themselves from involvement with the NRO 100G EE acquisition. 
COMM/IAO also received both verbal and email confirmation (ref email from Dec 
20, 2013) that NSA/IAD had not shared — nor would it share — any details regarding NRO’s 100G 
EE acquisition during its CCEP discussions with vendors. internal to COMM/IAO, no NSA field 
Se ae with the 100G EE acquisition have been involved — or will be involved — 
with the C evelopment, nor will those personnel share any 100G EE acquisition information 
with NSA/IAD personnel involved with the CCEP development. 





(2). (U) An assessment of the degree of OCI risk associated with the work to be performed and a 
determination that no OCI issues exist for the effort. 


(U) The degree of OCI risk associated with the work to be performed on this effort is very low 
based on the following. COMM/IAO reviewed its contractual and organizational relationships — 
including those of its SETA support staff — for potential conflict with the 100G EE acquisition, and 
concluded that there are no relationships that present OCI concerns. 


(USFECE) COMM/IAO has not participated in any CCEP discussions with vendors, and has made 

it clear that any potential NRO acquisition is separate from NSA/IAD’s CCEP development, and 

will continue to do so when the acquisition is posted to the ARC. Although NRO has shared draft 

100G EE acquisition documents with NSA/IAD, NRO has received both verbal and en(b)(3) 50 USC + 3605 
confirmation (ref email fron Dec 20, 2013) that NSA/IAD has not shared any details 

during its CCEP discussions with vendors. Internal to COMM/IAO, no NSA field personne 
involved with the 100G EE acquisition have been involved — or will be involved — with the CCEP 
development, nor will those personnel share any 100G EE acquisition information with NSA/IAD 
personnel involved with the CCEP development. 








(UAAFEt6} Furthermore, the technical requirements for each effort are derived through entirely 

separate paths. To illustrate, after receiving COMM DMP approval in September 2013 to 

proceed with the 100G EE acquisition, COMM/IAO released a Request for Information (RFI) to 

industry to highlight NRO’s interest and to gauge industry’s ability to deliver certain technical 

capabilities. That RFI included a partial list of requirements, many of which were derived from 

the publicly available Ethernet Security Specification (ESS) v1.0. Those requirements have since 

become the basis of the 100G EE Technical Specification that was released as part of the draft 

Request for Proposals (b)(3) 


























However, as COMM has no control or 
guarantee that a CCEP development will meet NRO technical or schedule requirements, it is not 
a viable option for satisfying mission needs. 





(U) To mitigate any perceived unfair advantage to vendor(s) pursuing the NSA/IAD CCEP 
development and interested in NRO’s 100G EE acquisition, COMM/IAO released a draft RFP that 
will include the technical specification and requirements for its desired 100G EE solution. 
COMM/IAO solicited feedback from all vendors on the proposed requirements. Furthermore, 
COMM/IAO explicitly stated in its draft RFP that its acquisition is separate and independent from 
any NSA/IAD CCEP development, and that no NRO COMM IAO 100G EE acquisition information 
has been or will be provided to vendors through NSA/IAD’s CCEP development or any other 
reason. 
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(U) Therefore, it is determined that no OCI issues exist for the effort. This 100G EE requirement 

was developed by the NRO to satisfy an internal mission need, whereas the potential CCEP 

development is managed only by the vendor and NSA/IAD with no NRO participation. That 

separation of responsibilities extends to NSA field personnel in COMM/IAO that(b)(3) 50 USC + 3605 
involved with the 100G EE acquisition, as they have no involvement in the CCEP development. 

Although both developments may use the same ESS v1.0 standard as the basis for requirements, 

that does not imply the two efforts present an inherent OCI, particularly as the standard is 

publicly available to all potential offerors. 






































Contracting Officer Technical Representative Contracting Officer 
Chief, [AO Contracts 
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